Practical relay attack on contactless transactions by using NFC mobile phones

Cryptology and Information Security Series

Volumn 8, Issue , 2012, Pages 21-32

  Francis, Lishoy ^a   Hancke, Gerhard ^a   Mayes, Keith ^a   Markantonakis, Konstantinos ^a  

^a UNIVERSITY OF LONDON   (United Kingdom)

Author keywords

Access control; Contactless; Identification; ISO 14443; Mobile phone; Near Field Communication (NFC); Payments; Practical implementation; Practical relay; Proximity; Relay; RFID; Security attack; Smart card; Transactions

Indexed keywords

ACCESS CONTROL; APPLICATION PROGRAMS; CELLULAR TELEPHONES; ELECTRONIC MONEY; IDENTIFICATION (CONTROL SYSTEMS); MOBILE DEVICES; MOBILE PHONES; MOBILE SECURITY; RADIO FREQUENCY IDENTIFICATION (RFID); SMART CARDS; TELEPHONE SETS;

CONTACT LESS; ISO 14443; PAYMENTS; PRACTICAL IMPLEMENTATION; PRACTICAL RELAY; PROXIMITY; RELAY; SECURITY ATTACKS; THE NEAR FIELD COMMUNICATION (NFC); TRANSACTIONS;

NEAR FIELD COMMUNICATION;

EID: 84888152161     PISSN: 18716431     EISSN: 18798101     Source Type: Book Series    
DOI: 10.3233/978-1-61499-143-4-21     Document Type: Conference Paper

References (65)

1. EMV. EMV Contactless Specifications for Payment Systems. EMV Communication Protocol Specification. Version 2.0, August 2007. Online: http://www.emvco.com/.
2. Visa® payWave™. Online: http://www.visaeurope.com/.
3. MasterCard® PayPass™. Online: http://www.paypass.com/.
4. International Civil Aviation Organization (ICAO). Document 9303 Machine Readable Travel Documents (MRTD). Part 1: Machine Readable Passports, 2005.
5. ISO/IEC 7501. Identification Cards - Machine Readable Travel Documents, October, 2005.
6. Transport for London Oyster Card. TFL, UK. Online: https://oyster.tfl. gov.uk.
7. Octopus. Octopus Cards Limited, Hong Kong. Online: http://www.octopus. com.hk/.
8. ISO/IEC 15693. Identification cards - Contactless integrated circuit cards - Vicinity cards.
9. HID Global. Access Control Solutions. Online: http://www.hidglobal.com/.
10. G. P. Hancke. Practical eavesdropping and skimming attacks on high-frequency RFID tokens. Journal of Computer Security - 2010 Workshop on RFID Security (RFIDSec'10 Asia), Volume 19, Issue 2 (April 2011), 259-288, 2011.
11. I. Kirschenbaum and A. Wool. How to Build a Low-Cost, Extended-Range RFID Skimmer. In Proceedings of 15th USENIX Security Symposium, pp 43-57, August 2006.
12. D. Oswald, T. Kasper and C. Paar. Side-Channel Analysis of Cryptographic RFIDs with Analog Demodulation. Springer LNCS. In Proceedings of RFIDSec 2011, Northampton, USA.
13. S.C. Bono, M. Green, A. Stubblefield, A. Juels, A.D. Rubin and M. Szydlo. Security Analysis of a Cryptographically-Enabled RFID Device. Proceedings of Usenix Security Symposium, 2005.
14. A. Juels, D. Molnar and D. Wagner. 2005. Security and Privacy Issues in E-passports. In Proceedings of First International Conference on Security and Privacy for Emerging Areas in Communications Networks (SECURECOMM '05). IEEE Computer Society, Washington, DC, USA, 74-88.
15. T.S. Heydt-Benjamin, D.V. Bailey, K. Fu, A. Juels and T. OHare. 2007. Vulnerabilities in first-generation RFID-enabled credit cards. In Proceedings of Financial Cryptography and Data Security, pp. 1-22, February, 2007.
16. G.P. Hancke, K.E. Mayes, K. Markantonakis. Confidence in Smart Token Proximity: Relay Attacks Revisited. Elsevier Computers & Security, Vol. 28, Issue 7, pp 615-627, October, 2009.
17. Near Field Communication (NFC) Forum. Online: http://www.nfc-forum.org.
18. Nokia C7. Nokia. Online: http://www.nokia.com/.
19. BlackBerry Bold 9900/9930. RIM. Online: http://www.blackberry.com/.
20. Samsung GT-I9020 (Google Nexus S). Samsung. Online: http://www.samsung. com/.
21. Google Wallet, Google Inc. Online: http://www.google.com/wallet/.
22. Orange Quick Tap, Orange France Telecom Group. Online: http://shop.orange.co.uk/mobile-phones/contactless/.
23. G. Madlmayr, J. Langer, C. Schaffer and J. Scharinger. NFC Devices: Security and Privacy. In Proceedings of 3rd International Conference on Availability, Reliability and Security, Barcelona 2008.
24. L. Francis, G.P. Hancke, K.E. Mayes and K. Markantonakis. Potential Misuse of NFC Enabled Mobile Handsets with Embedded Security Elements as Contactless Attack Platforms. In Proceedings of 1st Workshop on RFID Security and Cryptography (RISC'09), in conjunction with ICITST 2009, pp 1-8, November 2009.
25. R. Anderson. RFID and the Middleman. Conference on Financial Cryptography and Data Security, pp 46-49, December 2007.
26. Z. Kfir and A. Wool. Picking Virtual Pockets using Relay Attacks on Contactless Smartcard Systems. In Proceedings of IEEE/CreateNet SecureComm, pp 47-58, 2005.
27. G.P. Hancke. Practical Attacks on Proximity Identification Systems (short paper). In Proceedings of IEEE Symposium on Security and Privacy, pp 328-333, May, 2006. (Pubitemid 44753734)
28. Libnfc. Public Platform Independent Near Field Communication (NFC) Library. Online: http://www.libnfc.org/documentation/examples/nfc-relay.
29. M. Weiss. Performing Relay Attacks on ISO 14443 Contactless Smart Cards using NFC Mobile Equipment. Master Thesis, Technischen Universitat Munchen, Munich, Germany, 2010.
30. L. Francis, G.P. Hancke, K.E. Mayes and K. Markantonakis. Practical NFC Peer-to-Peer Relay Attack using Mobile Phones. In Proceedings of 6th Workshop on RFID Security (RFIDSec'10), LNCS, Springer-Verlag, June 2010.
31. W. Knight, The price of love, Elsevier Infosecurity, pp 30-33, Vol. 5, Iss. 1, January 2008. (Pubitemid 351241327)
32. M. Roberti. Are RFID-Enabled Credit Cards Safer Than Magstripe Cards? RFID Journal, September 2010. Online: http://www.rfidjournal.com/blog/entry/7870
33. ISO/IEC 18092 (ECMA-340). Information technology - Telecommunications and information exchange between systems - Near Field Communication Interface and Protocol (NFCIP-1). 2004.
34. ISO/IEC 14443. Identification cards - Contactless integrated circuit cards - Proximity cards.
35. FeliCa, Sony. Online: http://www.sony.net/Products/felica/.
36. Bluetooth Core Specification Version 2.1.+ EDR. Volume 2, July 2007.
37. Essentials for Successful NFC Mobile Ecosystems. NFC Forum White Paper. October 2008.
38. Oracle/Sun Microsystems. Java Card Platform Specification v2.2.1. Online: http://java.sun.com/.
39. NXP. Java Card Open Platform. Online: http://www.nxp.com/.
40. Global Platform. Card Specification v2.1.1. Online: http://www. globalplatform.org.
41. NXP Semiconductor. Mifare Standard Specification. Online: http://www.nxp.com/.
42. Third Generation Partnership Project. Characteristics of the Universal Subscriber Identity Module (USIM) application (Release 7), TS 31.102 V7.10.0 (2007-09).
43. SD Card Association. Online: http://www.sdcard.org/.
44. Candidate Technical Specification: Signature Record Type Definition. NFC Forum. October 2009.
45. NFC Data Exchange Format (NDEF). NFC Forum Technical Specification, Rev. 1.0, Jul. 2006.
46. M. Roland, J. Langer and J. Scharinger. Security Vulnerabilities of the NDEF Signature Record Type. In Proceedings of Third International Workshop on Near Field Communication, pp. 65-70, 2011.
47. C. Mulliner. Vulnerability Analysis and Attacks on NFC-Enabled Mobile Phones. In Proceedings of International Conference on Availability, Reliability and Security, ARES 2009, pp 695-700, March, 2009.
48. R. Verdult and F. Kooman. Practical Attacks on NFC Enabled Cell Phones. In Proceedings of Third International Workshop on Near Field Communication, pp. 77-82, 2011.
49. J.H. Conway. On Numbers and Games. Academic Press, 1976.
50. Y. Desmedt, C. Goutier and S. Bengio. Special Uses and Abuses of the Fiat-Shamir Passport Protocol. Advances in Cryptology (CRYPTO), Springer-Verlag LNCS 293, pp 21, 1987.
51. Y.C. Hu, A. Perrig and D.B. Johnson. Wormhole Attacks in Wireless Networks. IEEE Journal on Selected Areas in Communications (JSAC), pp 370-380, 2006.
52. G.P. Hancke and M.G. Kuhn. An RFID Distance Bounding Protocol. In Proceedings of IEEE/CreateNet SecureComm, pp 67-73, September 2005.
53. S. Drimer and S.J. Murdoch. Keep your enemies close: distance bounding against smartcard relay attacks. In Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium (SS'07), USENIX Association, Berkeley, CA, USA, 2007.
54. A. Francillon, B. Danev and S. Capkun. Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars, In Proceedings of Network and Distributed System Security Symposium (NDSS), 2011.
55. RFID IO Tools. Online: http://www.rfidiot.org/.
56. Oracle/Sun Microsystems. JSR-000082 Java API for Bluetooth 2.1, Online: http://jcp.org/aboutJava/communityprocess/final/jsr082/index.html.
57. Oracle/Sun Microsystems. JSR-000118 Mobile Information Device Profile 2.0, Online: http://jcp. org/aboutJava/communityprocess/final/jsr118/index.html.
58. Oracle/Sun Microsystems. JSR-000257 Contactless Communication API 1.0, Online: http://jcp.org/aboutJava/communityprocess/final/jsr257/index.html.
59. Nokia 6131 NFC SDK, Online: http://www.forum.nokia.com/.
60. Oracle/Sun Microsystems. Java Code Signing for J2ME, Online: http://www.oracle.com/technetwork/java/javase/tech/getcodesigningcertificate- 361306.html.
61. Uncovered: The hidden NFC potential of the Google Nexus S and the Nokia C7, Near Field Communications World, 13 February 2011. Online: http://www.nfcworld.com/2011/02/13/35913/.
62. Research In Motion Limited. BlackBerry v7.0.0 NFC API, Online: http://www.blackberry.com/.
63. Research In Motion Limited. Java Code Signing Keys, Online: http://www.blackberry.com/.
64. MIFARE DESFire EV1 contactless multi-application IC, Product short data sheet, Rev. 02, 6 March, 2009, Online: http://www.nxp.com/.
65. K. Nohl, D. Evans, Starbug and H. Plötz. Reverse-engineering a cryptographic RFID tag. In Proceedings of USENIX Security 2008, 185-193, 2008